{"id":"CVE-2019-12410","aliases":["EUVD-2019-0107","GHSA-cjw4-2w9r-r8mv","PYSEC-2019-196"],"status":"published","title":"Missing Initialization of Resource in Apache Arrow","description":"While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04608,"percentile":0.91739,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-909"],"published":"2019-11-08T18:04:52Z","modified":"2026-10-24T10:31:05Z","fixes":[{"ecosystem":"RubyGems","package":"red-arrow","fixed_in":["0.15.1"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"pyarrow","fixed_in":["0.15.1","0.15.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"red-arrow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.0"},{"fixed":"0.15.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"pyarrow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.0"},{"fixed":"0.15.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pyarrow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.0"},{"fixed":"0.15.1"}]}],"versions":["0.12.0","0.12.1","0.13.0","0.14.0","0.14.1","0.15.0"]},{"source":"osv","ecosystem":"RubyGems","package":"red-arrow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.0"},{"fixed":"0.15.1"}]}],"versions":["0.12.0","0.13.0","0.14.0","0.14.1","0.15.0"]},{"source":"osv","ecosystem":"PyPI","package":"pyarrow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.0"},{"fixed":"0.15.0"}]}],"versions":["0.12.0","0.12.1","0.13.0","0.14.0","0.14.1"]}],"products":[{"vendor":"apache","product":"arrow"},{"vendor":"apache software foundation","product":"apache arrow"}],"references":[{"url":"https://lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21126269%40%3Cdev.arrow.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2019/11/08/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/efd8bbf57427d3c303b5316d208a335f8d0c0dbe0dc4c87cfa995073%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12410","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21126269@%3Cdev.arrow.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/efd8bbf57427d3c303b5316d208a335f8d0c0dbe0dc4c87cfa995073@%3Cannounce.apache.org%3E","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/red-arrow/CVE-2019-12410.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cjw4-2w9r-r8mv","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyarrow/PYSEC-2019-196.yaml","tags":["web"]},{"url":"https://github.com/apache/arrow","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2019-12410","description":"While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.","status":"published","published":"2019-11-08T18:04:52Z","modified":"2024-08-04T23:17:40.008Z","updated_at":"2026-11-02T14:20:23.697579Z"}],"euvd":[{"id":"EUVD-2019-0107","description":"While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.","status":"published","published":"2019-11-08T18:04:52Z","modified":"2024-08-04T23:17:40Z","updated_at":"2026-11-03T02:40:45.973526Z"}],"ghsa":[{"id":"GHSA-cjw4-2w9r-r8mv","title":"Missing Initialization of Resource in Apache Arrow","description":"While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.","status":"published","published":"2022-05-24T17:00:40Z","modified":"2024-10-21T20:14:48Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-909"],"updated_at":"2026-11-02T14:38:12.325695Z"}],"nvd":[{"id":"CVE-2019-12410","description":"While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.","status":"published","published":"2019-11-08T19:15:10.287Z","modified":"2026-06-17T02:14:35.977Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-909"],"updated_at":"2026-11-02T14:05:35.052973Z"}],"osv":[{"id":"CVE-2019-12410","description":"While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.","status":"published","published":"2019-11-08T19:15:10.287Z","modified":"2026-10-24T10:31:05.675913121Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"GHSA-cjw4-2w9r-r8mv","title":"Missing Initialization of Resource in Apache Arrow","description":"While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.","status":"published","published":"2022-05-24T17:00:40Z","modified":"2024-10-21T20:26:49.848433Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-909"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"PYSEC-2019-196","description":"While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.","status":"published","published":"2019-11-08T19:15:00Z","modified":"2023-11-08T04:01:04.600457Z","updated_at":"2026-11-02T15:52:52.192131Z"}]}}